CSRF Bypass Leading to Bounce Rule Deletion in phpList

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in phpList versions before 3.7.0-RC5. It allows an attacker to delete arbitrary bounce rules by tricking an authenticated administrator into loading a crafted URL. The deletion endpoint uses a GET request without proper CSRF token validation, as the central check only enforces validation if a 'tk' parameter is present.

Useful 0 Not Useful 0

Detection Guidance

Check phpList admin logs for unexpected bounce rule deletions or GET requests to bouncerules.php with del=N parameters. Inspect network traffic for suspicious URLs containing bouncerules.php?page=bouncerules&del=.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to delete bounce rules from the phplist_bounceregex table without the administrator's knowledge. This could disrupt email bounce handling, leading to undelivered emails or incorrect bounce processing. The attack requires tricking the admin into loading a malicious link.

Useful 0 Not Useful 0

Compliance Impact

This CSRF vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized deletion of bounce rules, which may affect data integrity and audit trails. Unauthorized modifications to bounce rules could interfere with email delivery systems handling sensitive data, potentially violating integrity and accountability requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade phpList to version 3.7.0-RC5 or later. Ensure CSRF tokens are enforced in all deletion endpoints by verifying verifyCsrfGetToken() is called with enforce=true. Disable GET requests for deletion actions and use POST instead.

Useful 0 Not Useful 0